Problem solveGet help with specific problems with your technologies, process and projects.

Secure OWA to minimize your risks

There are a number of actions to take to implement OWA security, including obvious ones like creating strong password policies. Admins should also consider using other popular countermeasures to lessen risks.

I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.

Please check the box if you want to proceed.

I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.

Please check the box if you want to proceed.

By submitting my Email address I confirm that I have read and accepted the Terms of Use and Declaration of Consent.

threats. I plan to use Outlook Web App -- what are the risks and countermeasures of doing so? And what can I do to secure OWA in this situation?

Of all the clients I've supported, only a few opted to completely disable Outlook Web App (OWA) externally for security reasons. Not to discourage you, but my attempts to convince them otherwise in those instances did little to change their minds. When there are across-the-board security policies prohibiting Web-based access to internal data sources, it may already be a done deal. Based on your question, I sense you're part of such an organization that would be willing to disable OWA for security reasons.

Does this mean organizations that choose to externally implement OWA are oblivious to the potential security risk? Not necessarily. Most organizations want to implement OWA on the basis that it's a business requirement to facilitate communications, but also to do all they can to secure the connections. In many cases, it comes down to the benefits of OWA outweighing the risks.

I've seen organizations use a number of measures to secure OWA. Outside of obvious actions such as having stronger password policies, here are some common countermeasures for OWA risks.

Windows Integrated Authentication (NT Lan Manager/Kerberos) will store credentials at the session layer. Credentials can persist until the browser's action is terminated. FBA stores credentials as a cookie that has a timer expiry and can be deleted independently of the session. FBA uses basic authentication but requires SSL to encrypt credentials that are entered.

Internet-facing servers with the CAS role are more prone to attacks. Isolating the CAS role from the mailbox role's data can create an additional layer of protection.

Reverse proxies

Domain-joined machines that allow direct connections from the Internet, even via firewalls, are prone to attacks. Publishing Web applications like OWA to a reverse proxy allows external connections to occur on a non-domain joined proxy within a DMZ network.

Segmentation

Some OWA features could be considered a security/policy risk, like allowing the changing passwords via OWA. It's possible to disable OWA features that end users see either at the virtual directory level or by using an Outlook Web App Mailbox Policy.

Some advanced countermeasures to secure OWA that you could also consider include:

Two-factor authentication – Requires more than just a password, often described as "something you have and something you know"

One-time password - Unlike a static password, a one-time password changes each time the user logs in

About the author:Richard Luckett is a consultant and instructor specializing in messaging and unified communications. He's been a certified professional with Microsoft since 1996 and has 20 years of experience in the public and private sectors. He's a Microsoft Certified Trainer with more than 15 years of training experience with the Microsoft product line and received the Exchange MVP award in 2006, 2007 and 2008. He's also an expert in deploying and integrating Exchange Server and Lync Server. He leads the Microsoft training and consulting practice at LITSG.

Start the conversation

0 comments

Register

I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.

Please check the box if you want to proceed.

I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.